Group 04: Investigation Methodology and Scenarios

What is a strong general investigation process?

Understand why the alert triggered, identify affected entities and time range, review the evidence, build a timeline, pivot across data sources, establish normal behavior, determine scope, classify the activity, respond, and document the conclusion.

What should I review first when an alert triggers?

The detection logic, affected user or asset, timestamp, severity, supporting evidence, and reason the activity was considered suspicious.

What does pivoting mean during an investigation?

Using one piece of evidence, such as a user, IP address, hostname, process, domain, or hash, to find related activity.

Why should I establish a baseline?

Understanding normal behavior helps determine whether the observed activity is unusual, authorized, or potentially malicious.

How do I determine whether an alert is a false positive?

Compare the alert with supporting logs, user behavior, business context, authorized changes, related activity, and threat intelligence.

How would I investigate repeated failed logins followed by a successful login?

Review the user, source IP, device, location, timing, failure pattern, MFA results, normal behavior, related accounts, and activity after the successful login.

How would I investigate password spraying?

Look for a small number of common passwords attempted against many accounts from the same or related sources, then review successful logins and affected identities.

How would I investigate a suspicious login?

Review the user, IP address, device, location, timestamp, authentication method, MFA result, normal behavior, related sign-ins, and post-login activity.

How would I investigate a newly created administrator account?

Review who created and enabled it, group memberships, password settings, source device, authorization, subsequent activity, and related account changes.

How would I investigate suspicious PowerShell?

Review the full command line, parent and child processes, user, script content, encoded commands, network connections, file activity, persistence, and related endpoints.

How would I investigate communication with a malicious IP?

Validate the IP reputation, determine connection direction and frequency, identify the responsible process, inspect DNS and transferred data, search other hosts, and review business context.

How would I investigate a malware alert that was automatically remediated?

Confirm the remediation action, examine the origin and process tree, determine whether execution occurred, check persistence and network activity, and search for related activity on other systems.

How would I investigate suspected credential dumping?

Review which process accessed LSASS or credential stores, the user and privileges involved, command lines, endpoint detections, file creation, authentication activity, and possible lateral movement.

How would I investigate a suspicious scheduled task?

Review who created it, the command or file it executes, its schedule, path, parent activity, authorization, and related endpoint behavior.

How would I investigate a newly installed Windows service?

Review the creator, service name, binary path, signature, start type, command line, network activity, and whether the change was authorized.

How would I investigate an impossible-travel alert?

Compare locations, timestamps, IP ownership, VPN usage, devices, MFA results, session activity, and the user’s normal behavior.

How would I investigate unusual cloud-region activity?

Review the identity, action, resource, source IP, authentication method, normal operating regions, permissions changes, created resources, and related activity.

How would I investigate a phishing email?

Analyze the sender, reply-to address, headers, authentication results, domains, links, attachments, recipient actions, endpoint activity, and whether other users received it.

What should happen after confirming an account compromise?

Restrict or disable the account, revoke sessions and tokens, reset credentials, verify MFA, review activity, determine scope, and address any persistence or unauthorized changes.

What should I do when important logs are missing?

Preserve available evidence, identify the visibility gap, check alternate data sources, escalate appropriately, document uncertainty, and avoid unsupported closure.

What should I do when a system owner says suspicious activity was authorized?

Request details and authorization evidence, compare the explanation with logs, document the context, and close only when the evidence supports the claim.

How would I respond to a critical internet-facing vulnerability?

Confirm exposure and ownership, determine exploitation likelihood, apply remediation or compensating controls, monitor for attack activity, and validate the fi